Business needs help to act on cyber security advice

Organisations need help to act on all the information they receive about cyber security, the London Digital Security Centre has learned since its inception in 2015

Small businesses need help in tackling cyber crime and embracing cyber security, not just information, according to John Unsworth, chief executive of the London Digital Security Centre (DSC).

“Information is good, but action is better,” he told the Whitehall Media Enterprise Cyber Security Conference in London. “There is a lot of information, but businesses want help in implementing it.”

The London DSC was set up as a not-for-profit organisation in 2015 by the Mayor’s Office for Policing and Crime to help the city’s roughly one million small businesses protect themselves from cyber crime.

The centre is run as a joint venture between the Mayor of London, the Metropolitan Police Service and the City of London Police to protect small businesses that are at the heart of the economy.

“The point of the centre is to help businesses act on the wealth of information that is out there to take control of their cyber security by implementing controls that make a difference,” said Unsworth.

“Part of our role is also to cut through the noise and show businesses that the things that will make a difference for the majority of small businesses cost little or nothing to implement.”

Many of the things small businesses can do to improve their cyber security only have a cost in time and effort, said Unsworth. “Cyber security is not always about buying a technical solution,” he added.

Investments in security technologies depend on the size of the business, the business operating model and what the business is trying to achieve, he said. “So for businesses that handle sensitive information, there is a cost because they need to ensure that data is protected and demonstrate that they have a good security posture.”

The role of the London DSC is to identify and prioritise business needs in terms of cyber security controls, said Unsworth.

Partnership approach

“The beauty of the DSC for me is the fact that it is a partnership approach that involves practical help from the private sector and academia to help ensure small businesses are not victims of cyber crime,” he said. “We are there to help small businesses embrace the [digital] world that has been thrust upon them.”

Unsworth appealed to private sector organisations that can offer help to sign up as partners, because many small businesses are struggling to meet the challenges of the digital world. “We want to work with partners who can help us make a difference,” he said.

Underlining the need to support small business in the face of cyber crime, Unsworth said that although more than 50% of crime reported to police is cyber enabled in some way, only 0.1% of policing resources across England and Wales are dedicated to the prevention and detection of cyber crime.

This is symptomatic of the fact that not everyone recognises that cyber crime is a big problem and it tends to be under-reported, he said. “What we need to start doing is creating a little bit of evidence noise about what the issues are, so we can get the right type of response to all of this.”

Unsworth said the London DSC is 100% about outreach and engaging with businesses to prevent crime from happening in the first place. “If we can cut through the crimes that should never happen, law enforcement can concentrate on serious organised crime group activity,” he said.

In reality, said Unsworth, there is really not a lot to the vast majority of cyber attacks that are successful against small businesses. “They generally involve cyber criminals manipulating victims into doing something,” he said.

“What we have got to change and shift is this behaviour, so what we have done is to set about getting face-to-face with small businesses and talk to them one-to-one rather than relying on social media campaigns to get businesses to take cyber security more seriously.”

This involves visiting every London borough and spending time knocking on high street businesses’ doors and speaking to business owners, he said.

“When you start speaking to them in simple language, they soon realise that all cyber security is really about is understanding what you are using, what you are connected to, and if you have got the right controls in place,” said Unsworth.

“We provide the opportunity for businesses to ask the questions without embarrassment or cost, and then we will help them find the right answers.”

Small businesses in denial

According to Unsworth, many small businesses are in denial when it comes to cyber crime – they tend to think it will not happen to them because they don’t understand why they might be targeted.

“We want to help businesses avoid the regret of not doing something that could have prevented a cyber attack by helping them to embrace cyber security and putting in appropriate controls,” he said.

“We want to talk to businesses about things that are specific to their business and their area that we know will help make a difference and put them on the road to progress in closing the gaps that can be exploited by cyber criminals.”

The London DSC offers tailored staff training and education programmes, security assessments and digital footprint assessments to members – but membership is free of charge.

“We take members through digital security cycles by looking at their security posture, comparing that with what good looks like, identifying the things they need to do to improve, and then helping them to implement those actions,” said Unsworth.

The centre has also created a “marketplace” of selected products and services to help London’s businesses protect themselves.

“To cut through the supplier noise, we have identified organisations across the country that we believe provide the right products and services that small businesses need,” said Unsworth. “We shouldn’t underestimate this because it is hard, and so any help we can get to do this should be welcome.”

In closing, Unsworth reiterated his appeal to private sector organisations to partner with the London DSC to help small businesses get the cyber crime protection they need. “We want to be able to do things that will make a difference,” he said.